Oops: general protection fault, probably for non-canonical address 0xdffffc0000000021: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]
CPU: 0 UID: 0 PID: 12 Comm: kworker/u8:0 Not tainted 6.15.0-rc5-syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025
Workqueue: events_unbound nsim_dev_trap_report_work
RIP: 0010:read_pnet include/net/net_namespace.h:409 [inline]
RIP: 0010:dev_net include/linux/netdevice.h:2708 [inline]
RIP: 0010:ip_ignore_linkdown include/linux/inetdevice.h:272 [inline]
RIP: 0010:fib_lookup_good_nhc+0x12d/0x3d0 net/ipv4/fib_trie.c:1408
Code: 74 08 4c 89 e7 e8 53 22 3d f8 41 bd 08 01 00 00 4d 03 2c 24 e8 b4 8b 71 01 4c 89 e8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ef e8 25 22 3d f8 41 be f0 06 00 00 4d 03
RSP: 0018:ffffc90000007208 EFLAGS: 00010216
RAX: 0000000000000021 RBX: ffff8880594f8c80 RCX: dffffc0000000000
RDX: 0000000000000100 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffff8880594f8c97 R08: ffffc9000000742f R09: ffffc90000007400
R10: dffffc0000000000 R11: fffff52000000e86 R12: ffff88802850e800
R13: 0000000000000108 R14: 0000000000000001 R15: 1ffff1100b29f192
FS: 0000000000000000(0000) GS:ffff8881260cb000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c29436e CR3: 0000000030918000 CR4: 0000000000350ef0
Call Trace:
fib_table_lookup+0x964/0x16e0 net/ipv4/fib_trie.c:1594
__ip_dev_find+0x288/0x4e0 net/ipv4/devinet.c:160
ip_route_output_key_hash_rcu+0x1f9/0x2330 net/ipv4/route.c:2747
ip_route_output_key_hash+0x1b9/0x2e0 net/ipv4/route.c:2683
__ip_route_output_key include/net/route.h:169 [inline]
ip_route_output_flow+0x2a/0x150 net/ipv4/route.c:2911
inet_sk_rebuild_header+0x91a/0x1cc0 net/ipv4/af_inet.c:1322
__tcp_retransmit_skb+0x262/0x1530 net/ipv4/tcp_output.c:3358
tcp_retransmit_skb+0x33/0x440 net/ipv4/tcp_output.c:3458
tcp_retransmit_timer+0x18ba/0x3200 net/ipv4/tcp_timer.c:627
tcp_write_timer+0x162/0x2e0 net/ipv4/tcp_timer.c:738
call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1789
expire_timers kernel/time/timer.c:1840 [inline]
__run_timers kernel/time/timer.c:2414 [inline]
__run_timer_base+0x61a/0x860 kernel/time/timer.c:2426
run_timer_base kernel/time/timer.c:2435 [inline]
run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2445
handle_softirqs+0x286/0x870 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:debug_check_no_locks_freed+0xec/0x1c0 kernel/locking/lockdep.c:6721
Code: c7 04 24 00 00 00 00 9c 8f 04 24 f7 04 24 00 02 00 00 0f 85 bb 00 00 00 41 f7 c5 00 02 00 00 74 01 fb 65 48 8b 05 f4 09 d7 10 <48> 3b 44 24 08 0f 85 b5 00 00 00 48 83 c4 10 5b 41 5c 41 5d 41 5e
RSP: 0018:ffffc900001178e8 EFLAGS: 00000206
RAX: 1817bc10ae47a200 RBX: ffff88801b2fda00 RCX: ffff888030990901
RDX: 0000000000000000 RSI: ffff888030e7f000 RDI: ffff888030e7e000
RBP: 0000000000212008 R08: 0000000000000000 R09: 1ffffffff1efdb2e
R10: dffffc0000000000 R11: fffffbfff1efdb2f R12: ffff88801a042140
R13: 0000000000000202 R14: ffff88801b2fe590 R15: 0000000000000004
slab_free_hook mm/slub.c:2308 [inline]
slab_free mm/slub.c:4642 [inline]
kfree+0x102/0x440 mm/slub.c:4841
skb_kfree_head net/core/skbuff.c:1058 [inline]
skb_free_head net/core/skbuff.c:1070 [inline]
skb_release_data+0x69a/0x890 net/core/skbuff.c:1097
skb_release_all net/core/skbuff.c:1162 [inline]
__kfree_skb net/core/skbuff.c:1176 [inline]
consume_skb+0x9e/0xf0 net/core/skbuff.c:1408
nsim_dev_trap_report drivers/net/netdevsim/dev.c:821 [inline]
nsim_dev_trap_report_work+0x7cf/0xb80 drivers/net/netdevsim/dev.c:851
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xade/0x17a0 kernel/workqueue.c:3319
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
kthread+0x711/0x8a0 kernel/kthread.c:464
ret_from_fork+0x4e/0x80 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:read_pnet include/net/net_namespace.h:409 [inline]
RIP: 0010:dev_net include/linux/netdevice.h:2708 [inline]
RIP: 0010:ip_ignore_linkdown include/linux/inetdevice.h:272 [inline]
RIP: 0010:fib_lookup_good_nhc+0x12d/0x3d0 net/ipv4/fib_trie.c:1408
Code: 74 08 4c 89 e7 e8 53 22 3d f8 41 bd 08 01 00 00 4d 03 2c 24 e8 b4 8b 71 01 4c 89 e8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ef e8 25 22 3d f8 41 be f0 06 00 00 4d 03
RSP: 0018:ffffc90000007208 EFLAGS: 00010216
RAX: 0000000000000021 RBX: ffff8880594f8c80 RCX: dffffc0000000000
RDX: 0000000000000100 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffff8880594f8c97 R08: ffffc9000000742f R09: ffffc90000007400
R10: dffffc0000000000 R11: fffff52000000e86 R12: ffff88802850e800
R13: 0000000000000108 R14: 0000000000000001 R15: 1ffff1100b29f192
FS: 0000000000000000(0000) GS:ffff8881260cb000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c29436e CR3: 0000000030918000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
0: 74 08 je 0xa
2: 4c 89 e7 mov %r12,%rdi
5: e8 53 22 3d f8 call 0xf83d225d
a: 41 bd 08 01 00 00 mov $0x108,%r13d
10: 4d 03 2c 24 add (%r12),%r13
14: e8 b4 8b 71 01 call 0x1718bcd
19: 4c 89 e8 mov %r13,%rax
1c: 48 c1 e8 03 shr $0x3,%rax
20: 48 b9 00 00 00 00 00 movabs $0xdffffc0000000000,%rcx
27: fc ff df
* 2a: 80 3c 08 00 cmpb $0x0,(%rax,%rcx,1) <-- trapping instruction
2e: 74 08 je 0x38
30: 4c 89 ef mov %r13,%rdi
33: e8 25 22 3d f8 call 0xf83d225d
38: 41 be f0 06 00 00 mov $0x6f0,%r14d
3e: 4d rex.WRB
3f: 03 .byte 0x3